[tracker1]

In reading this a protocol that supports two initial statements upon connection/negotiation as follows...

    s: http/2.0 {SERVER INFO}
    c: connect host/   <-- no path
    s: OK {server-cert/key}
    -- all futher requests encrypted against public key/cert
    c: session-start {client key/cert}
    s: SESSION: {session id} ({domain1},{domain2},...)
    c: (COMMAND|get|put|post|delete) {PATH}
    s: OK
       or
       DENIED ### (reason)   <-- response code & reason
       or
       REDIRECT host/(path)  <-- if the file is physically on another backend
    c: {OTHER REQUEST HEADERS START}

after a session is started, the client may make other requests

    s: http/2.0 {SERVER INFO}
    c: connect host/{path}
    s: OK {server-cert/key} or DENIED ### Reason
    -- all futher requests encrypted against public key/cert
    c: session-join {SESSION_ID} {client key/cert}
    s: OK or DENIED...
    c: {COMMAND} {path}

from there, the "session_id" can be a key for server-side value storage/lookup, etc... sent over the encrypted channel